CVE-2022-4883 is a high-severity vulnerability affecting x.org libxpm, where processing .Z or .gz files can lead to arbitrary code execution. The library's reliance on the PATH environment variable to locate external compression programs allows a malicious user to hijack program execution. With a CVSS score of 8.8, this flaw presents a significant risk due to its low attack complexity and potential for high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.5.15CPE matchmatch criteria | cpe:2.3:a:x.org:libxpm:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A flaw was found in libXpm. When processing files with .Z or .gz extensions the library calls external programs to compress and uncompress files relying on the PATH environment variable to find these programs which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
Feb 14, 2023libXpm: compression commands depend on $PATH
Jan 17, 2023